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Sir: 

I, J. B. Kraft, the attorney herein, declare that: 
I am the attorney herein. 

Prior to February 5, 2001, I received a copy of 
International Business Machines Corporation's Invention 
Disclosure AUS8-2000- 1262 , entitled: "Self -morphing file to 
elude hacker capture" which was assigned International 
Business Machines Corporation (IBM) Attorney Docket No. 
AUS920000941US1, which is attached hereto as Exhibit A, with 
its dates customarily blacked out. This disclosure provided 
the basic disclosure for the present Patent Application. 

In due course within my regular workload schedule, 
after preliminary discussions with the inventors, I 
commenced the actual written preparation of the present 
patent application on February 5, 20 01 and completed my 
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final draft of the application on February 12, 2001. On 
that date, the application and the claims therein were 
substantially in their present form. On or about February 
12, 2001, I forwarded the final draft of the present patent 
application to IBM's IPLaw Department. 

Based partly on my knowledge, and partly upon 
information and belief, IBM's IPLaw Department proceeded to 
obtain review by the inventors herein, some minor 
corrections were made, and the application was filed in the 
United States Patent and Trademark Office on March 8, 2001, 
(24 days after my final draft was completed) . 

Attached hereto and marked Exhibit B are copies pages 
of my Diary with entries during the period I was working on 
the present application. The entries indicate that I 
commenced the writing of the application on February 5, 2001 
and that I completed my work on the application on February 
12, 2001; the application is initially designated by its 
Attorney Docket Number: "AUS920000941" , and on subsequent 
entries, by "0941 docket". The entries indicate that I 
continuously diligently worked on the application for a 
total of 49 hours during the period. 

I hereby declare that all statements made herein are of 
my own knowledge and are true and that all statements made 
on information and belief are believed to be true; and 
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further that these statements were made with the knowledge 
that willful false statements and the like so made are 
punishable by fine or imprisonment, or both, under Section 
1001 of Title 18 of the United States Code and that such 
willful false statements may jeopardize the validity of the 
application or any patent issued thereon. 
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Main Idea 



Self-morphing file to elude hacker capture. 



1 . Describe your invention, stating the problem solved (if appropriate), and indicating the advantages of 
using the invention. 

This is typical of what happens when a hacker breaks into a supposedly secure 

y \ 0 a / 

a) break in via a security hole 

b) log into the machine as root 

c) try reading or trashing files _ 

d) if a file has kerberos protection, download the file to local machine for cracking at a later time. 

This disclosure proposes a file attribute that allows it to: 

1) rename itself 

2) move itself to another directory 

3) change if s own sum check by adding a few junk bits to the end of the file 

4) notifying the owner of the kerberos protected file (in a secret method) about the changes. 

So what would happen is that if a person broke into a machine as root, they might try to read the contents 
of the file "customer_credit_cards". This will fail because, although the person is root, they are not 
ketberds authenticated. The read fails, and then internal logic within the filesystem detects that this file 
has a auto-rename-move attribute in it. It then renames the file "dowJones_avg", appends a small file 
(for example /etc/motd) to the end of the file, then moves it over to /usr. The filesystem then creates a 
log of this change and places this record in a secret location in a secret filename (for example 
/usr/bin/x.html). By doing this, the hacker will be fooled into still looking for the file 
"customer_credit_cards" and/or looking for the same file by scanning for all files with the same original 
sumcheck. But, they will fail because the file has been moved, renamed, and the surricheck harmlessly 
changed with a static file added to it. 

An alternative to this idea is to move/change/rename the file, but leave a bogus copy of the file 
w customer_creditjcards" M posstoly with counterfeit credit card numbers (no real customers) that can help 
the authorities track down the users of the "stolen" credit card numbers. 

2. How does the invention solve the problem or achieve an advantage^ description of "the invention", 
including figures inline as appropriate)? 

This idea will continually hide the file and try to jump one step ahead of people probing a system looking 
for a file. It does not delete the file and notifies the kerberos owner of the file of the history of the attacks 
on the file and the location of the file as it goes into hiding. 

3. If the same advantage or problem has been identified by others (inside/outside IBM), how have those 
others solved it and does your solution differ and why is it better? 

Have not seen this type of evasion before. 

4. If the invention is implemented in a product or prototype, include technical details, purpose, disclosure 
details to others and the date of that implementation. 

not currently implemented. 

'Critical Questions ( Questions 1 - 7 must be answered) 
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Sir: 



it Gerald F, McBrearcy declare that; 

I . am one of the inventors and applicants herein, 

X have read the Declaration of our Attorney J.. B. 
Kraft,; filed herewith. 

gased upon information and belief and knowledge- my 
Declaration made herein and the Declaration of J, B'. Kraft, 
attorriey establish the existence of the written concept from 
befor* the February 16, 2001 filing date of published US 
Patent Application: 20020038296, N. «- Margolus et al. . and 
due diligence to the March 6, 2001 filing date of the 
present application. 

t have reviewed the independent claims in the presehL 
application, and declare prior to February 16, 2001 the 
inventors herein had completed tho full concept of the 
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combination of elements set forth in these claims and had 
recorded the same in the written disclosure. Exhibit "A" 'of, 
the Declaration of j. a. Kraft; and prior to February 16, 
2001, ;the present invention was fully disclosed in the final 
draft of this application submitted to IBM's IPLaw 
Department on February 12, 2001. 

I hereby declare that all statements made herein are o% 
my own knowledge and are true and that all statements made 
oh information and belief axe believed to be true; and 
further that these statements were mad© with the knowledge 
that Willful false statements and the like so made are 
piinistiable by fine or imprisonment, or both, under Section ; 
1001 of Title 18 of the United States Code and that such 
willful false statements may jeopardise the validity of Che 
application or any patent issued thereon. 




Gerald McBrea 



Date 
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